Flow Of Personal Information Research Articles

Contextual Integrity and Personal Health Information Sharing in Online Social Networks

Many online social network (OSN) users exchange health-related information on OSNs to manage their health, obtain support, and offer assistance to others facing similar medical challenges. Nonetheless, OSN users are concerned about the privacy of their health information. Extant studies on online information privacy have largely resorted to a calculus perspective, focusing on the costs and benefits of information exchange with commercial vendors. Such a perspective, however, fails to capture the nuanced flows of personal health information (PHI) on OSNs, which involves more than two parties. To address this gap and further advance the research on information privacy, this paper embraces the theory of contextual integrity to explore the distinctive contextual idiosyncrasies of PHI flow on OSNs. In particular, we examine how context-specific values and norms affect OSN users’ personal privacy norms and their PHI disclosure intentions. Our theory-driven empirical results suggest that contextual values and normative expectations related to technology control, legislation, and peer users collectively influence OSN users’ personal privacy norms. In addition, perceived personal value and perceived altruistic value serve as motivators to promote PHI disclosure intentions, working in tandem with personal privacy norms. The key findings of the study also have important implications for policymakers and OSN providers in the context of OSN-mediated healthcare through (1) advancing our understanding of the complex dynamics of PHI flow on OSNs and (2) designing effective information privacy measures (i.e., policies, technical features, and programs) to uphold contextual integrity and nurture the development of patient-centered healthcare paradigms.

Mapping the flow of personal information in the TRE-SC voter registration from the perspective of the LGPD

Resumo Os dados pessoais são usados para as mais diversas finalidades econômicas e políticas, tornando-se imprescindível que a capacidade de garantir a sua privacidade também seja aperfeiçoada. Essa pesquisa objetiva analisar o fluxo de informações no processo de alistamento no cadastro eleitoral do Tribunal Regional Eleitoral de Santa Catarina à luz da Lei Geral de Proteção de Dados Pessoais. Além de ser caracterizada como qualitativa e descritiva, esta pesquisa é um estudo de caso, quanto aos procedimentos, é realizada uma pesquisa bibliográfica e teve como instrumento de coleta o questionário. Os resultados revelaram lacunas significativas em relação à conformidade com a Lei Geral de Proteção de Dados Pessoais, abrangendo transparência, qualidade, segurança e acesso às informações pessoais. Com base nesses resultados, foram propostas diretrizes estratégicas, táticas e operacionais para melhorar o fluxo de informações no alistamento eleitoral.

BALANCE OF EFFICIENCY AND SECURITY: IMPROVEMENT OF CHINA'S PERSONAL INFORMATION EXIT COMPLIANCE PATH

The cross-border flow of personal information is the inevitable requirement of the development of Internet technology and global data exchange. Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation (W. Gregory Voss, 2020). At present, China's personal information exit compliance path mainly includes security assessment, standard contract, and professional certification and so on. These compliance paths correspond to different exit situations of personal information, which not only reflect the will of the state supervision, but also guarantee the autonomy of the personal information processor in managing the exit business activities, it plays an important role in promoting the orderly flow of personal information in accordance with the law, but there are still some problems, such as unclear applicable standards, lack of connection with international rules and insufficient autonomy of industry supervision, etc., the system design is biased towards the needs of national security and public interest, neglecting the efficiency improvement of cross-border flow of personal information. Therefore, this article will take the personal information exit facing the risk and the supervision necessity as the breakthrough point, through the analysis related to China's personal information exit regulation legal provisions and normative documents, from the perspective of efficiency and security, this paper evaluates the three compliance paths of personal information exit, and puts forward some suggestions on how to improve the balance between efficiency and security of China's compliance path of personal information exit.

Patient Perspectives and Preferences for Consent in the Digital Health Context: State-of-the-art Literature Review.

The increasing integration of digital health tools into care may result in a greater flow of personal health information (PHI) between patients and providers. Although privacy legislation governs how entities may collect, use, or share PHI, such legislation has not kept pace with digital health innovations, resulting in a lack of guidance on implementing meaningful consent. Understanding patient perspectives when implementing meaningful consent is critical to ensure that it meets their needs. Consent for research in the context of digital health is limited. This state-of-the-art review aimed to understand the current state of research as it relates to patient perspectives on digital health consent. Its objectives were to explore what is known about the patient perspective and experience with digital health consent and provide recommendations on designing and implementing digital health consent based on the findings. A structured literature search was developed and deployed in 4 electronic databases-MEDLINE, IEEE Xplore, Scopus, and Web of Science-for articles published after January 2010. The initial literature search was conducted in March 2021 and updated in March 2022. Articles were eligible for inclusion if they discussed electronic consent or consent, focused on the patient perspective or preference, and were related to digital health or digital PHI. Data were extracted using an extraction template and analyzed using qualitative content analysis. In total, 75 articles were included for analysis. Most studies were published within the last 5 years (58/75, 77%) and conducted in a clinical care context (33/75, 44%) and in the United States (48/75, 64%). Most studies aimed to understand participants' willingness to share PHI (25/75, 33%) and participants' perceived usability and comprehension of an electronic consent notice (25/75, 33%). More than half (40/75, 53%) of the studies did not describe the type of consent model used. The broad open consent model was the most explored (11/75, 15%). Of the 75 studies, 68 (91%) found that participants were willing to provide consent; however, their consent behaviors and preferences were context-dependent. Common patient consent requirements included clear and digestible information detailing who can access PHI, for what purpose their PHI will be used, and how privacy will be ensured. There is growing interest in understanding the patient perspective on digital health consent in the context of providing clinical care. There is evidence suggesting that many patients are willing to consent for various purposes, especially when there is greater transparency on how the PHI is used and oversight mechanisms are in place. Providing this transparency is critical for fostering trust in digital health tools and the innovative uses of data to optimize health and system outcomes.

GDPR Compliant Data Storage and Sharing in Smart Healthcare System: A Blockchain-Based Solution

Smart healthcare systems provide user-centric medical services to patients based on collected information of patients inducing personal health information (PHI) and personal identifiable information (PII). The information (PII and PHI) flows into the smart healthcare system with or without any regulation and patient concern with the help of new information and communication technologies (ICT). The use of ICT comes with the security and privacy issues of collected PII and PHI data. The Europe Union has published the General Data Protection Regulation (GDPR) to regulate the flow of personal information. Towards this end, this paper proposes a blockchain-based data storage and sharing framework for a smart healthcare system that complies with the “Privacy by Design” rule of the GDPR. The personal information collected from patients is stored on off-chain storage (IPFS), and other information is stored on the blockchain ledger, which is visible to all participants. The smart contracts are designed to share the PII data with another participant based on prior permission of the data owner. The proposed framework also includes the deletion of PII and PHI in the system as per the “Right to be Forgotten” GDPR rule. Security and privacy analyses are performed for the framework to demonstrate the security and privacy of data while sharing and at rest. The comparative performance analysis demonstrates the benefit of the proposed GDPR-compliant data storage and sharing framework using blockchain. It is evident from the reported results that the proposed framework outperforms the state-of-the-art techniques in terms of performance metrics in a smart healthcare system.

YourAdvalue

The Real Time Bidding (RTB) protocol is by now more than a decade old. During this time, a handful of measurement papers have looked at bidding strategies, personal information flow, and cost of display advertising through RTB. In this paper, we present YourAdvalue, a privacy-preserving tool for displaying to end-users in a simple and intuitive manner their advertising value as seen through RTB. Using YourAdvalue, we measure desktopRTB prices in the wild, and compare them with desktop and mobileRTB prices reported by past work. We present how it estimates ad prices that are encrypted, and how it preserves user privacy while reporting results back to a data-server for analysis. We deployed our system, disseminated its browser extension, and collected data from 200 users, including 12000 ad impressions over 11 months. By analyzing this dataset, we show that desktop RTB prices have grown 4.6x over desktop RTB prices measured in 2013, and 3.8x over mobile RTB prices measured in 2015. We also study how user demographics associate with the intensity of RTB ecosystem tracking, leading to higher ad prices. We find that exchanging data between advertisers and/or data brokers through cookie- syncronization increases the median value of displayed ads by 19%. We also find that female and younger users are more targeted, suffering more tracking (via cookie synchronization) than male or elder users. As a result of this targeting in our dataset, the advertising value (i) of women is 2.4x higher than that of men, (ii) of 25-34 year-olds is 2.5x higher than that of 35-44 year-olds, (iii) is most expensive on weekends and early mornings.

‘I was prepared to become infected as a frontline medical staff’: A survey of Australian emergency department staff experiences during COVID‐19

ObjectiveTo identify challenges faced by Australian hospital healthcare staff during the COVID‐19 pandemic.MethodsWe conducted an online survey (30 June–15 August 2020) of healthcare staff from Australian emergency and infectious disease departments. Participants were contacted via professional organisations and asked about preparedness, personal protective equipment (PPE), information flow, patient care, infection concerns, workload and mental health. We calculated the proportion of answers to yes/no and Likert‐style questions; free‐text responses were analysed thematically.ResultsRespondents (n = 162) were 23–67 years old, 98% worked in EDs, 68% were female, 87% from Queensland, and most worked as nurses (46%) or specialists (31%). Respondents felt their workplace was prepared for the pandemic (79%), had sufficient information about PPE (83%); none were sent home because of PPE shortages. Eighty‐five percent received sufficient information from official bodies and 50% were aware of the National COVID‐19 Clinical Evidence Taskforce guidelines. Most (83%) had sufficient information to provide optimal patient care, but 24% experienced unfair/abusive patient behaviour. Most (76%) were concerned about becoming infected by patients, 67% about infecting patients, and 78% about infecting someone at home. Workload decreased for 82% but 42% looked after more patients. Fifty‐seven percent experienced additional work‐related stress: 60% reporting experiencing anxiety and 53% experiencing burnout, with 36% and 46% continuing to experience these, respectively. Key challenges included: emotional, workplace/organisational, family/loved ones and PPE factors.ConclusionThe Australian system provided sufficient information and PPE. Staff experienced considerable stress, infection concerns and emotional challenges, which merit consideration in preparing for the future.

Social Globalisation and Efficiency of Microfinance Institutions Nexus: Empirical Evidence on Financial and Social Efficiency

The main objective of this paper is to identify the impacts of social globalisation comprised of personal contacts, information flows and cultural proximity to the financial and social efficiency of Microfinance Institutions (MFIs). This study had conducted two stages of analysis, in which the first stage is Data Envelopment Analysis (DEA) approach and the second stage is multiple panel regression analysis under Generalized Least Square estimation method. The results exhibit that the overall MFIs operated in a relatively optimal scale during the period of the study. However, these MFIs were managerially inefficient in utilising their resources to achieve both social and financial efficiency. The results from panel regression analysis showed that only personal contacts exhibit a significant positive relationship with the financial efficiency of MFIs. This study could contribute new insights and implications to various parties, such as MFIs, policy makers, investors and researchers to improve the efficiency of MFIs.

YourAdvalue: Measuring Advertising Price Dynamics without Bankrupting User Privacy

The Real Time Bidding (RTB) protocol is by now more than a decade old. During this time, a handful of measurement papers have looked at bidding strategies, personal information flow, and cost of display advertising through RTB. In this paper, we present YourAdvalue, a privacy-preserving tool for displaying to end-users in a simple and intuitive manner their advertising value as seen through RTB. Using YourAdvalue, we measure desktop RTB prices in the wild, and compare them with desktop and mobile RTB prices reported by past work. We present how it estimates ad prices that are encrypted, and how it preserves user privacy while reporting results back to a data-server for analysis. We deployed our system, disseminated its browser extension, and collected data from 200 users, including 12000 ad impressions over 11 months. By analyzing this dataset, we show that desktop RTB prices have grown 4.6x over desktop RTB prices measured in 2013, and 3.8x over mobile RTB prices measured in 2015. We also study how user demographics associate with the intensity of RTB ecosystem tracking, leading to higher ad prices. We find that exchanging data between advertisers and/or data brokers through cookie-synchronization increases the median value of display ads by 19%. We also find that female and younger users are more targeted, suffering more tracking (via cookie synchronization) than male or elder users. As a result of this targeting in our dataset, the advertising value (i) of women is 2.4x higher than that of men, (ii) of 25-34 year-olds is 2.5x higher than that of 35-44 year-olds, (iii) is most expensive on weekends and early mornings.

Security Management Suitable for Lifecycle of Personal Information in Multi-User IoT Environment.

In recent years, as all actions of Internet users become information, the importance of personal information is emphasized, but in reality, the management of personal information is still insufficient. With the advent of the concept of sharing systems such as the sharing economy, the numbers of IoT application services (for example, a healthcare service using sharing IoT devices, or a vehicle sharing system with IoT devices) using users’ personal information are increasing, but the risk of using personal information is not managed. To solve this issue, the European GDPR stipulates the content of personal information protection. In this paper, we present a method to securely manage personal information in IoT devices in IoT application environments in accordance with the GDPR. We first describe the lifecycle stages of personal information occurring in IoT application services and propose a method to securely manage personal information at each stage of the lifecycle according to the flow of personal information in IoT devices. We also evaluated the usefulness and applicability of the proposed scheme through two service scenarios. Since the proposed method satisfies the requirements for personal information management in IoT application environments, it is expected to contribute to the development of the IoT business field that handles personal information.

The Welfare Impact of Targeted Advertising Technologies

We analyze the welfare implications of consumer data sharing, and restrictions to that sharing, in the context of online targeted advertising. Targeting technologies offer firms the ability to reach desired audiences through intermediary platforms. The platforms run auctions in real time to display ads on internet sites, leveraging consumers’ personal information collected online to personalize the ads. The online advertising industry posits that targeted advertising benefits advertising firms (that is, merchants who want to target ads to the desired consumers), consumers who see ads for preferred products, and the intermediary platforms that match consumers with firms. However, the claims that targeted advertising benefits all players involved have not been fully vetted in the literature. We develop an analytical model to analyze the economic and welfare implications of targeting technologies for those three players under alternative consumer information regimes. The regimes differ in the type and amount of consumer data available to the intermediary and to the advertising firms, and reflect the presence or absence of technological or regulatory restrictions to personal information flows. We find evidence of incentive misalignment among the players, as the intermediary prefers to share only a subset of consumer information with firms, whereas advertising firms prefer having complete information about the consumers. As such, a strategic intermediary with the ability to control which information is shared during the auction can have an incentive to use only the information that maximizes its payoff, overlooking the interests of both advertising firms and consumers. The information regimes that maximize consumer welfare vastly differ depending on consumers’ heterogeneity along two dimensions: a horizontal dimension, capturing consumer’s heterogeneity in product preferences; and a vertical dimension, capturing consumers’ heterogeneity in purchase power. Consumers prefer none of their personal information to be used for targeting only in limited circumstances. Otherwise, consumers are either indifferent or prefer only specific types of information to be used for targeting.

Surveillance and privacy – Beyond the panopticon. An exploration of 720-degree observation in level 3 and 4 vehicle automation

On the path to high-level vehicle automation, the degree of surveillance both inside and outside the car increases significantly. Consequently, ethical considerations are becoming central to questions around surveillance regimes and data privacy implicit in level 3 and 4 vehicle automation. In this paper, we focus on outputs from the EU Horizon 2020 project Vision Inspired Driver Assistance Systems (VI-DAS). In particular, we assess the VI-DAS 720-degree observation technology, critical to ensuring a safe Human Machine Interaction (HMI), from multiple theoretical perspectives to contribute to a better understanding of the phenomena of privacy. As a synonym for surveillance, we started our evaluation with Bentham's ideation of the panopticon. From there, it is a relatively short step to radical Foucauldian critiques that offered more dystopian technologies of power. However, both theorems demonstrate a limited understanding of the issue of data privacy in the context of safe transportation along the evolution of highly automated vehicles. Thus, to allow the debate to move beyond more binary discussions on privacy versus control/power and to a certain degree escape the shadow of the panopticon, we applied the Nissenbaum four theses framework of Contextual Integrity (CI). Her decision heuristic allowed us to introduce structure and a degree of precision in our thinking on the matter of privacy that represents a step forward to phenomena of privacy in a specific context. Our approach concludes that the VI-DAS 720-degree observation technology can respect the user's privacy through an appropriate flow of personal information. However, the flows of personal data must be strongly regulated to ensure that data is seen as a value in terms of a commodity to protect human life and not seen as an asset that needs to be turned into value in terms of capital or the facilitation of asymmetric power-relations.

Smartphone Users' Persuasion Knowledge in the Context of Consumer mHealth Apps: Qualitative Study.

BackgroundPersuasion knowledge, commonly referred to as advertising literacy, is a cognitive dimension that embraces recognition of advertising, its source and audience, and understanding of advertisers’ persuasive and selling intents as well as tactics. There is little understanding of users’ awareness of organizations that develop or sponsor mobile health (mHealth) apps, especially in light of personal data privacy. Persuasion knowledge or recognition of a supporting organization’s presence, characteristics, competencies, intents, and persuasion tactics are crucial to investigate because app users have the right to know about entities that support apps and make informed decisions about app usage. The abundance of free consumer mHealth apps, especially those in the area of fitness, often makes it difficult for users to identify apps’ dual purposes, which may be related to not only helping the public manage health but also promoting the supporting organization itself and collecting users’ information for further consumer targeting by third parties.ObjectiveThis study aims to investigate smartphone users’ awareness of mHealth apps’ affiliations with 3 different types of supporting organizations (commercial, government, and nonprofit); differences in users’ persuasion knowledge and mHealth app quality and credibility evaluations related to each of the 3 organization types; and users’ coping mechanisms for dealing with personal information management within consumer mHealth apps. MethodsIn-depth semistructured interviews were conducted with 25 smartphone users from a local community in midwestern United States. Interviews were thematically analyzed using inductive and deductive approaches. ResultsParticipants indicated that their awareness of and interest in mHealth app–supporting organizations were secondary to the app’s health management functions. After being probed, participants showed a high level of persuasion knowledge regarding the types of app-supporting organizations and their promotional intents. They thought that commercial companies sponsored mHealth apps mostly as entertainment tools, whereas noncommercial entities sponsored mHealth apps for users’ education. They assigned self-promotional motives to commercial organizations; however, they associated commercial mHealth apps with good quality and functioning. Noncommercial entities were perceived as more credible. Participants were concerned about losing control over personal information within mHealth apps supported by different organizations. They used alternative digital identities to protect themselves from privacy invasion and advertising spam. They were willing to trade some personal information for high-quality commercial mHealth apps. There was a sense of fatalism in discussing privacy risks linked to mHealth app usage, and some participants did not perceive the risks to be serious.ConclusionsThe discussion of and recommendations for the safe and ethical use of mHealth apps associated with organizations’ promotional strategies and personal data protection are provided to ensure users’ awareness of and enhanced control over digitalized personal information flows. The theoretical implications are discussed in the context of the Persuasion Knowledge Model and dual-processing theories.

Knapsack graph-based privacy checking for smart environments

A smart environment consisting of sensors and actuators that network a physical space makes the lives of users extremely convenient. In such environments, service providers collect, store, and process a huge amount of personal information from the users, and provide appropriate services in return. Processing personal information helps service providers dispense personalized services to users. The flow of personal information requires legal documents such as privacy preferences and privacy policies from the users and service providers, respectively. A software agent (to be installed either at the client’s or server’s end) performs the privacy checking (i.e., matches the service provider’s privacy policies with the user’s privacy preferences), and produces a decision based on a “take it or leave it” approach. Often, this check is too restrictive such that the user is denied the services, even if the privacy policies partially satisfy the user preferences. In this work, the privacy checking problem is envisaged as a knapsack problem, and to address it, we derive (i) knapsack privacy checking (KPC), and (ii) knapsack graph-based privacy checking (KPC-G) techniques. The system developed using these techniques finds the services that best match the user’s privacy preferences as well as the service provider’s policies, with a twofold functionality: (a) it recommends the best matching services based on user-supplied tolerance values, or (b) it solves an optimization problem to suggest services after adjusting the user-supplied tolerance values. Our experimental results demonstrate the effectiveness of the proposed model.

Digital Economy Barriers to Trade Regulation Status, Challenges, and China's Response

At present, the WTO's multilateral trading system faces the acute challenge of adapting to the digital and commercial economies' rapid evolution. The recent regional trade agreements embody the corresponding achievements of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP), Economic Partnership Agreement (EPA), and the United States Mexico Canada Agreement (USMCA) in facilitating the free flow of data and regulating digital barriers to trade. The General Data Protection Regulation (GDPR) has also developed several new norms for promoting free data flow and protecting personal data privacy. The new regional trade agreements fulfil the digital trade threshold, prohibit delocalization by the data center and establish organized frameworks for cross-border data flow and personal privacy protection. In the negotiations on trade services agreements, China should focus on implementing a new management structure, speeding up domestic legislation and legislative reforms, and establishing a legal framework that promotes the free flow of data, fair competition, and personal information among corporations.

The Kings of the Corona Crisis: The Impact of the outbreak of Covid‐19 on Small‐scale Producers in Hungary

SummaryThe Covid‐19 pandemic has fundamentally reshaped our lives. Its effects on the sales and use of marketing channels of small‐scale Hungarian producers are addressed here. Based on the level of proximity, sales channels were classified into three types. Due to local regulations concerning restrictions on movement, it was only impersonal (online) channels that survived, or the opposite type, i.e. very personal ones involving the face‐to‐face meeting of producers and consumers in the private spaces (mostly homes) of one of the parties. Results from the survey of 136 producers reveal that 60 per cent suffered an economic loss due to loss of sales, while 10 per cent increased their sales. Successful producers were those lucky enough to be operating within the fresh fruit and vegetable sector, within which consumer demand increased significantly. The parallel use of several sales channels before the virus outbreak increased subsequent chances of success by increasing the probability that some of the channels would remain operational. Furthermore, successful producers had invested a lot of work pre‐Covid into maintaining private relationships with their customers; a situation that proved vital during times of restrictions. Also, the former moved fast, and were open enough to learn and make use of the opportunities modern technology offered them.

Japan’s Personal Information Protection Policy Under Pressure

This article explores the politics surrounding the recent data transfer agreement between Japan and the European Union, with a focus on the linkage between Japanese domestic politics and foreign pressure on Japan’s personal information protection policy. The agreement may be seen as one of mutual recognition, in that Japan and the EU mutually recognized the other as providing an “adequate level of protection” for personal data. However, a close examination of the case suggests that Japan made substantial efforts to meet the EU’s standards for adequacy in order to enhance the interests of transnationalized Japanese firms that rely on the flow of personal information across borders. In sum, the latest changes in Japanese personal information protection regulation paved the way for the Japan-EU data transfer agreement; these changes were precipitated by the extraterritorial effect of the EU’s data protection laws, which had resonated within Japan’s domestic politics.

Protection of personal information: An experiment involving data value chains and the use of personal information for marketing purposes in South Africa

South Africa enacted the Protection of Personal Information Act 4 of 2013 (POPI) in an effort to curb the misuse of customers’ personal information by organisations. The aim of this research was to establish whether the South African insurance industry is adhering to certain prescripts of POPI, focusing on direct marketing requirements. An experiment was utilised to monitor the flow of personal information submitted to 20 insurance companies requesting short-term insurance quotations, using new e-mail addresses and phone numbers. The results of the experiment indicate that 92% of the marketing communication received did not have prior consent from the researcher. Contact was made by companies outside the sample, indicating third-party sharing. 86% of the unsolicited short message service (SMS) communication received required customers to pay for unsubscribing from SMSs, which is not in line with regulatory requirements. The non-compliance evident in this experiment acts as an early warning to the insurance industry and South Africa, prompting a more concerted effort towards preparation of compliance with POPI. A personal information processing management framework is proposed to aid the insurance industry in understanding how personal information can be processed in line with the requirements of the Act.

Protection of Personal Information Act 2013 and data protection for health research in South Africa

Abstract The Protection of Personal Information Act (POPIA) [No.4 of 2013] is the first comprehensive data protection regulation to be passed in South Africa and it gives effect to the right to informational privacy derived from the constitutional right to privacy It is due to come into force in 2020, and seeks to regulate the processing of personal information in South Africa, regulate the flow of personal information across South Africa’s borders, and ensure that any limitations on the right to privacy are justified and aimed at protecting other important rights and interests. Although it was not drafted with health research in mind, POPIA will have an impact on the sharing of health data for research, in particular biorepositories. It is now timely to consider the impact of POPIA on biorepositories, and the necessary changes to their access and sharing arrangements prior to POPIA coming into force.

Regulation of information flows as Central Bank functions? Implications from the treatment of Account Aggregators by the Reserve Bank of India

This paper seeks to understand the role of the Indian Central Bank in regulating information flows through Account Aggregators. These are licensed entities exclusively dedicated to collecting, retrieving and sharing customers’ financial information with other financial entities with the customers’ consent. By regulating Account Aggregators as non-bank providers, the Reserve Bank of India (RBI) has opened up many foundational questions for Central Banking regulation. This paper investigates the issues that emerge for regulatory consideration, by tracing the evolution of the RBI’s regulatory approach to Account Aggregators. It then considers the regulatory approach taken by the Kingdom of Bahrain and the European Union (EU) to regulate “account information services” pursuant to broader Open Banking mandates. The analysis is used to respond to the central question driving this enquiry: Should Central Banks regulate and enable the flow of personal information? In doing so, the paper addresses the RBI’s approach in the Master Directions on Non-Banking Financial Company - Account Aggregator, 2016. We propose specific changes to anchor the Master Directions to the Central Bank’s core mandate and objectives, and to harmonise it with the broader regulatory rubric for data protection in India.